CVE-2026-54477: Admin Panel Missing Security Headers (clickjacking / XSS)

Advisory

Field	Value
CVE	CVE-2026-54477
ICSA	ICSA-26-183-03 (Gardyn IoT Hub)
CVSS 3.1	5.4 (Medium)
Vector (3.1)	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Vector (4.0)	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CWE (CISA-assigned)	CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax)
CWE (researcher)	CWE-693 (Protection Mechanism Failure), CWE-1021 (Improper Restriction of Rendered UI Layers)
Researcher	Michael Groberman
Published	2026-07-02
Coordinated finding	Gr0m-043 (admin panel missing all security headers)

Product

Field	Value
Vendor	Gardyn
Product	Gardyn Home Kit, Gardyn Studio
Component	Admin panel (admin.gardyn.io, Netlify)
Affected Versions	Home Firmware < master.627, Studio Firmware < master.627, Cloud API < 2.12.2026

Summary

The admin panel is served with no security headers beyond HSTS — no Content-Security-Policy, no X-Frame-Options, no X-Content-Type-Options, no Permissions-Policy. This enables clickjacking and cross-site scripting against authenticated admin sessions.

Vulnerability Details

Headers present

Header	Value
server	Netlify
strict-transport-security	max-age=31536000
cache-control	no-cache

Headers missing

Missing header	Consequence
Content-Security-Policy	No restriction on script sources; injected script executes freely
X-Frame-Options	Panel can be embedded in an attacker iframe (clickjacking)
X-Content-Type-Options	MIME sniffing
Permissions-Policy	Camera / microphone / geolocation unrestricted
Referrer-Policy	Full URL (incl. tokens) may leak via Referer
Cross-Origin-Opener/Resource-Policy	No cross-origin isolation

Clickjacking scenario

With no X-Frame-Options / CSP frame-ancestors, an invisible overlay iframe over an authenticated admin session can trigger privileged actions on click, e.g. PiReboot, DeleteUser, SwitchBannedDevice.

XSS amplification

Combined with the client-side injection sinks identified in Gr0m-028 (22 dangerouslySetInnerHTML instances, 35 innerHTML assignments), the absence of CSP means any successful payload executes without restriction, enabling data exfiltration and session-propagating behavior.

Mapping to coordinated findings

Aspect	Detail
Gr0m-043	Admin panel served with zero security headers beyond HSTS; enables clickjacking + XSS
CWE reconciliation	Researcher classified CWE-693 / CWE-1021; CISA assigned CWE-644. Both describe the missing-header condition
Note	This finding was asserted by the vendor to CERT/CC as remediated in March 2026; publication as a CISA CVE establishes it on the federal record as a valid, standalone finding

Remediation

Per ICSA-26-183-03, Gardyn states the IoT Hub deployed infrastructure has been updated to address the listed vulnerabilities. Recommended control set (Netlify _headers / netlify.toml):

[[headers]]
  for = "/*"
  [headers.values]
    Content-Security-Policy = "default-src 'self'; script-src 'self'; frame-ancestors 'none';"
    X-Frame-Options = "DENY"
    X-Content-Type-Options = "nosniff"
    Referrer-Policy = "strict-origin-when-cross-origin"
    Permissions-Policy = "camera=(), microphone=(), geolocation=()"

---

Researcher: Michael Groberman (Gr0m) · Case: CERT/CC VU#653116 · Advisory: ICSA-26-183-03